CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0 to 9.5.2 are vulnerable due to improper HTML escaping in the Top Navigation Bar block, allowing users with page creation or renaming privileges to inject malicious scripts through child page names. This vulnerability enables the execution of scripts in the context of any visitor, editor, or administrator, potentially leading to unauthorized access to sensitive information or actions within the application. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of cross-site scripting (XSS) attacks.
Original NVD Description
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.